upstream unencrypted headers

[michaelkirk-signal]

Ok this is ready for review.

This builds on top of #439

• Adds more documentation
• Adds some sanity checking asserts to make sure you're specifying either:
  • a key-spec
  • a key+salt.
• simplifies the migration utils to only require a recordSalt callback (and tries to make it clearer what that callback should do).

Using a key spec allows you to skip expensive key derivation which occurs every time you create a new DB connection.

Since we're generating random key data, as opposed to having the user specify a passphrase, there's no reason not to just generate a key-spec length key and skip derivation.

FWIW - We've been using this in production for about 9 months.